Network/VoIP Expert: Fix VPN, VPS, Minor WireGuard Tweaks & Yeastar S20 (Read Rules)

*** STRICT RULES - READ BEFORE BIDDING ***
1. DO NOT BID if you do not have direct, hands-on experience with ALL of these specific devices:
- Cudy P2 5G Router
- DrayTek Vigor 2915 Router
- Yeastar S20 PBX
I will NOT explain how these devices work or provide any tutorials.
2. ALL work MUST be done remotely via AnyDesk ONLY. No direct access, VPN credentials, or passwords will be handed over.
3. Do NOT message me asking "What is the problem?" or "What is your budget?". The entire problem, infrastructure, and scope of work are detailed precisely below. Your bid is your final price. Any messages asking these questions will result in an immediate BLOCK.

---------------------------------------------------------
--- PROJECT DETAILS & SCOPE OF WORK ---

We are looking for an experienced Network & System Engineer to troubleshoot and optimize our site-to-site network and VoIP infrastructure between Saudi Arabia (5G behind CGNAT) and Egypt (Fiber).

Current Infrastructure:
- KSA Site: DrayTek Vigor 2915 router cascaded behind a Cudy P2 5G router.
- Egypt Site: Yeastar S20 PBX.
- Cloud VPS (Contabo, Germany): Used as a relay to bypass the KSA 5G CGNAT. It runs Docker, Caddy (reverse proxy) with a No-IP DDNS (e.g., wjlest3.ddns.net).
- Tunnels: WireGuard is ALREADY SET UP and working perfectly on the Contabo server for the site-to-site link. Remote users currently use DrayTek's Smart VPN (SSL VPN).

The Issues:
1. Port 443 Conflict: The previous developer mapped port 443 on the VPS (via Caddy) directly to the DrayTek Web GUI. This conflicts with DrayTek's SSL VPN, causing remote VPN connection failures.
2. VoIP Instability, Audio Drops & Packet Loss: Mobile workers using the Yeastar Linkus app suffer from random drops, the app getting stuck on "Reconnecting", and poor/choppy audio. This is caused by routing VoIP inside a TCP-based VPN over a WireGuard tunnel on a 5G network (MTU fragmentation and TCP meltdown).
3. Linkus Usability: We want the Yeastar Linkus app to work seamlessly without requiring users to manually keep the client VPN connected all day.

Scope of Work (Tasks to be done via AnyDesk):
1. VPS & Docker/Caddy Reconfiguration: Resolve the port 443 conflict on the VPS. Forward the necessary Yeastar S20 PBX ports (SIP 5060, Linkus ports, RTP range, etc.) directly through the VPS so mobile users can register the Linkus app natively via the DDNS hostname (bypassing the client VPN for calls).
2. Minor WireGuard Tweaks: The WireGuard server on Contabo is already fully configured and functional. You only need to verify/adjust the MTU and MSS clamping values to prevent packet fragmentation over the 5G cellular network, and ensure "PersistentKeepalive" is active to prevent CGNAT UDP session timeouts.
3. VoIP Codec Optimization: Configure and enforce lightweight, low-bandwidth audio codecs (e.g., G.729 or Opus) on the Yeastar S20 and Linkus app to ensure stable audio quality and eliminate jitter over the 5G link.
4. Client VPN Setup: Reconfigure the DrayTek remote dial-in VPN (switch from SSL to IPsec/IKEv2 or L2TP) so that authorized users can smoothly access internal IP devices (printers, router, PBX, etc.) from outside using local IPs.
5. General Check: Ensure the Cudy P2 5G router has DMZ pointing to the DrayTek to avoid Double NAT, and verify SIP ALG is disabled across all routing devices.

Required Skills:
- Advanced VPNs (WireGuard MTU/MSS tuning, IPsec/IKEv2).
- Linux Server, Docker, and Reverse Proxies (Caddy).
- VoIP troubleshooting (SIP, RTP, Codecs: G.729/Opus, NAT Traversal) and Yeastar S20 PBX configuration.
- DrayTek and Cudy routers, cellular networking (CGNAT traversal).